security: remove plaintext journal metadata columns

src/security_event_store.py

@@ -75,10 +75,6 @@ class SecurityEventStore:
                 """
                 CREATE TABLE IF NOT EXISTS security_events (
                     id INTEGER PRIMARY KEY AUTOINCREMENT,
-                    kind TEXT,
-                    method TEXT,
-                    device_label TEXT,
-                    target TEXT,
                     payload TEXT,
                     created_at INTEGER NOT NULL,
                     status TEXT NOT NULL DEFAULT 'completed',
@@ -97,8 +93,11 @@ class SecurityEventStore:
                 connection.execute(
                     "ALTER TABLE security_events ADD COLUMN operation_id TEXT"
                 )
-            if "payload" not in columns:
-                self._migrate_plaintext(connection)
+            plaintext_columns = {"kind", "method", "device_label", "target"}
+            if "payload" not in columns or plaintext_columns.intersection(columns):
+                self._migrate_plaintext(
+                    connection, has_payload="payload" in columns
+                )
             connection.execute(
                 "CREATE INDEX IF NOT EXISTS security_events_created "
                 "ON security_events(created_at DESC, id DESC)"
@@ -113,20 +112,19 @@ class SecurityEventStore:
                 "Security activity is temporarily unavailable"
             ) from exc
 
-    def _migrate_plaintext(self, connection: sqlite3.Connection) -> None:
+    def _migrate_plaintext(
+        self, connection: sqlite3.Connection, *, has_payload: bool
+    ) -> None:
         connection.execute("PRAGMA secure_delete = ON")
+        payload_column = "payload," if has_payload else "NULL AS payload,"
         rows = connection.execute(
-            "SELECT id, kind, method, device_label, target, created_at, status, operation_id "
-            "FROM security_events ORDER BY id"
+            f"SELECT id, {payload_column} kind, method, device_label, target, "
+            "created_at, status, operation_id FROM security_events ORDER BY id"
         ).fetchall()
         connection.execute(
             """
             CREATE TABLE security_events_encrypted (
                 id INTEGER PRIMARY KEY AUTOINCREMENT,
-                kind TEXT,
-                method TEXT,
-                device_label TEXT,
-                target TEXT,
                 payload TEXT,
                 created_at INTEGER NOT NULL,
                 status TEXT NOT NULL DEFAULT 'completed',
@@ -136,6 +134,7 @@ class SecurityEventStore:
         )
         for (
             event_id,
+            payload,
             kind,
             method,
             device_label,
@@ -149,7 +148,10 @@ class SecurityEventStore:
                 "(id, payload, created_at, status, operation_id) VALUES (?, ?, ?, ?, ?)",
                 (
                     event_id,
-                    self._seal_event(event_id, kind, method, device_label, target),
+                    payload
+                    or self._seal_event(
+                        event_id, kind, method, device_label, target
+                    ),
                     created_at,
                     status,
                     operation_id,